Ever since the pandemic, we have grown used to seeing those black-and-white squares everywhere. We scan them to see the menu at a restaurant, to pay for parking or to connect to Wi-Fi. It is convenient and fast, right? Well, this is exactly the convenience hackers are relying on in 2026.
The new fraud method is called Quishing (a combination of "QR" and "Phishing"). At Altanet Craiova we have noticed an increase in these attacks in public spaces and we want to teach you how to tell a useful code from a dangerous trap.
What is Quishing and how does the "sticker attack" work?
Unlike complicated viruses that require programming, Quishing is frighteningly simple and physical. The hacker does not break into the restaurant's server. They simply print their own QR code on a sticker and paste it over the original code on the table or on the parking meter.
You take out your phone and scan the code on the table, convinced you will see the menu of the day, but you are redirected to a fake site. There you are asked to "confirm your age" by entering your Facebook details or to "pay a small fee" by entering your card details. The second you hit Enter, the hacker has received everything.
Where are you most exposed to this risk?
Hackers choose crowded places, where people are in a hurry and not paying attention:
- Public parking meters: This is the scammers' favourite place. They paste a fake code that says "Scan here to pay for parking online". The site looks identical to the city hall's, but your money goes elsewhere.
- Restaurant menus: If the menu is stuck directly on the table, check that there is no other layer of paper stuck on top of it.
- Poles and bus stops: Posters that promise "Prize contests" or "Free Wi-Fi" if you scan the code.
How do you scan safely? (Golden rules)
You do not have to stop using the technology, but you have to be a little more suspicious. Here is what to do before you raise your phone:
- The touch test: Before scanning, run your finger over the code. If you feel the edges of a sticker pasted over the original poster, do NOT scan it. Immediately tell the staff of the venue.
- Check the link ("Preview"): Most modern phones show you a small text with the site's address before opening it. If you scan a menu and the link is bit.ly/kjsd83 instead of restaurant-name.ro, it is a trap.
- Avoid direct payments through QR: If you can, use the official parking app or pay at the counter. It is much safer than a site opened from a code found on the street.
To see how widespread this phenomenon is and how the authorities are reacting, you can read the warnings issued by Kaspersky about the dangers of Quishing.
Conclusion
A QR code is just a shortcut to a website. If you would not click a dodgy link received by SMS, you should not scan a dodgy code stuck on a pole either. Stay vigilant and watch out for overlaid "stickers".
Do you want to train your employees on physical and digital security risks? Our team offers consulting and complete IT services for companies. Visit our contact page and protect your business.
This material is part of the Altanet educational series on digital safety. Want to know what other risks you are exposed to this year? See The complete list of cyber threats in 2026.